Privacy Policy

Last updated: August 7, 2026

1. Introduction

Nanbu (“Nanbu,” “we,” “us,” or “our”) operates the website nanbu.in (the “Platform”). This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you use our Platform.

This Privacy Policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

By using the Platform, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Information You Provide Directly

Account information: Name, email address, password (hashed and salted, never stored in plaintext), and profile details you choose to provide.
Creator application information: Display name, handle, bio, category, and any additional information submitted during the Creator application process.
Content: Text, images, videos, audio files, and other media uploaded to the Platform by Creators.
Communications: Messages sent through the Platform’s direct messaging and broadcast features, and any communications sent to our support team.

2.2 Information from Third-Party Services

YouTube OAuth data: Connecting a YouTube channel is required to apply as a Creator. It is how we confirm an applicant controls the channel they are linking. We request a single read-only scope (youtube.readonly) via Google’s OAuth 2.0 protocol and make a single API call, which returns the channel ID and the channel’s public subscriber count. From that connection we store only: the channel ID, the public subscriber count, whether and when ownership was verified, and a refresh token encrypted with AES-256-GCM at the application layer. We do not read, store, or request private videos, watch history, analytics, comments, or the identities of a channel’s subscribers, and we never post, modify, or delete anything on a Creator’s channel. Members do not connect a YouTube account; this applies to Creators only. We do not derive aggregated, anonymised or statistical data from YouTube information: the channel ID and subscriber count are stored as received and used only as described in Section 2.2a. Nanbu’s use of the YouTube API Services is additionally governed by the YouTube Terms of Service, and Google’s own handling of your data by the Google Privacy Policy.
Payment information (Members): Payment details (UPI ID, card information, bank account details) are collected and processed directly by our payment processor, Razorpay Software Private Limited. Nanbu does not store your full payment card numbers, CVV, or UPI PIN. We receive only transaction confirmation data (transaction ID, amount, status, payment method type) from Razorpay.
Creator verification (KYC) information: To verify a Creator’s identity and payout destination before any payout, we collect the Creator’s PAN and either a bank account number or a UPI ID, together with the account-holder name those registries return. These identifiers are encrypted at rest (AES-256-GCM); our screens display only masked forms (for example, ABCDE****F), and the full values are transmitted to our verification provider, Cashfree Payments (Section 4.1), solely to confirm them against official records. UPI verification uses a small refunded test transfer (“penny drop”) and runs only after the Creator’s explicit consent in the verification flow. This applies to Creators only; Members are never asked for these documents.

2.2a Google API Services User Data Policy

Nanbu’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, this means we request only the read-only YouTube scope needed to confirm a Creator owns the channel they are linking; we use that data solely to verify that ownership during Creator review and to display the verified channel on the Creator’s own page; we do not transfer it to third parties except as needed to provide the Platform, comply with law, or in a merger as described in Section 4; we do not use it for advertising; and we allow no human to read it except with the Creator’s explicit consent, for security or abuse investigations, to comply with law, or where the data has been aggregated and anonymised.

Withdrawing access: a Creator may revoke Nanbu’s access to their YouTube account at any time at myaccount.google.com/permissions. Revocation takes effect immediately and ends our ability to read any YouTube data. To also have the stored connection record and the encrypted token erased from Nanbu, write to support@nanbu.in and we will delete them.

2.3 Information Collected Automatically

Device and browser information: IP address, browser type and version, and operating system, as recorded in standard server logs.
Usage data: Pages visited and referral URLs. Creator pages record aggregate daily visit counts by source with no visitor identity attached. We do not record time spent on pages, scrolling, or other interaction patterns (see Section 3a).
Cookies and local storage: Session cookies for authentication, and preference cookies for Platform functionality. See Section 9 for details.

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing and operating the Platform: Creating and managing your account, processing subscriptions, delivering content, and facilitating communication between Creators and Members.
Content moderation: Scanning uploaded media (images and videos) using Amazon Web Services (AWS) Rekognition, a machine-learning-based image and video analysis service, to detect and prevent prohibited content (including NSFW, violent, and otherwise objectionable material) from being published on the Platform. This scanning occurs before content is made visible to any user.
Payment processing: Facilitating subscription payments and Creator payouts through Razorpay.
Communication: Sending you transactional emails (subscription confirmations, payout notifications, account security alerts) and, where you have opted in, service-related announcements.
Security and fraud prevention: Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and other illegal activities.
Legal compliance: Complying with applicable laws, regulations, legal processes, or government requests.
Platform improvement: Analyzing usage patterns to improve the Platform’s functionality, performance, and user experience. Product analysis is conducted using our own database queries. In addition, we use two cookieless measurement services from Vercel (our hosting provider): Vercel Web Analytics, which records aggregated page views, referrers, and coarse device/country information, and Vercel Speed Insights, which records anonymous page-performance timings. Neither sets cookies, fingerprints your device, tracks you across other websites, or is used for advertising.

3a. Discovery Personalization

To suggest creators you might want to support, we may record a small set of high-intent actions while you are signed in: the searches you run, the creator pages you open (at most once per creator per day), and which discovery shelf you clicked through. We never record how long you look at anything, how you scroll, your mouse movements, or any activity while you are signed out.

Purpose: personalizing the “For you” shelf and improving how creators are found. Never advertising, never profiling beyond this purpose, and never an input to what a creator you already support may show you.
Retention: these records are deleted after 90 days automatically.
Your controls: you can switch personalization off (recording stops immediately), clear the history, and set or remove your stated interests, all from Settings. The data is included in your account export, and erased with your account.

We do not sell, rent, or trade your personal information to advertisers, data brokers, or any other third parties for their marketing purposes.

We share your information only in the following limited circumstances:

4.1 Service Providers

Razorpay (Payment Processor): Payment transaction data is shared securely with Razorpay for processing subscription payments and Creator payouts. Razorpay is a RBI-licensed payment aggregator and is bound by its own privacy and security policies.
Cashfree Payments (Creator Verification): A Creator’s PAN and payout account details (bank account or UPI ID) are transmitted securely to Cashfree solely to verify them against official records before payouts are enabled (Section 2.2). Cashfree is an RBI-regulated payments company and is bound by its own privacy and security policies. This applies to Creators only.
Vercel (Hosting and Measurement): The Platform is hosted on Vercel, whose servers process standard request data (IP address, user agent) to serve pages, and which provides the cookieless Web Analytics and Speed Insights services described in Section 3. Vercel processes this data in accordance with its own privacy policy.
Amazon Web Services (AWS) (Content Moderation): Uploaded media files are transmitted securely to AWS Rekognition for automated content moderation scanning. AWS processes this data in accordance with the AWS Privacy Policy.
Supabase (Authentication and Database): User account data and application data are stored in our Supabase database with Row-Level Security (RLS) policies ensuring data isolation between users.
Cloudflare (Media Storage and CDN): Creator- uploaded media files are stored on Cloudflare R2 and served through Cloudflare’s network. Access to media is controlled via signed URLs.
Resend (Email Service): Transactional email data (email address, email content) is shared with Resend for delivering notifications and account communications.
Vercel (Hosting): Our frontend application is hosted on Vercel. Server-side rendering requests may process user request data through Vercel’s infrastructure.

4.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or government authority, or if we believe in good faith that such disclosure is necessary to comply with legal obligations, protect our rights or safety, prevent fraud, or respond to an emergency involving the safety of any person.

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change via a prominent notice on the Platform or by email.

5. Data Storage & Security

5.1 Storage

Your data is stored on secure servers provided by our infrastructure partners (Supabase for database, Cloudflare R2 for media storage). Data may be stored and processed in data center locations outside of India as determined by our infrastructure providers, in compliance with applicable data protection laws.

5.2 Security Measures

We implement industry-standard security measures to protect your data, including:

Encryption of data in transit using TLS/SSL.
Encryption of data at rest for sensitive data stores.
Application-layer AES-256-GCM encryption for stored OAuth tokens (e.g., YouTube refresh tokens).
Password hashing using secure, salted hashing algorithms (handled by Supabase Auth).
Row-Level Security (RLS) policies at the database level ensuring users can only access their own data.
Signed URLs with expiry for media access, preventing unauthorized direct access to stored files.

While we strive to use commercially acceptable means to protect your personal information, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

Account data: Retained for the duration of your account and for a reasonable period thereafter (up to 180 days) to allow for account recovery or compliance with legal obligations.
Creator content: Retained for as long as the Creator maintains it on the Platform. Deleted content is removed from our active systems within a reasonable timeframe, though backup copies may persist for up to 90 days.
Transaction records: Retained for a minimum of 8 years as required under Indian tax and financial regulations (Income Tax Act, 1961 and GST Act, 2017).
Moderation logs: Records of content moderation actions are retained for compliance and audit purposes.
YouTube connection data: The channel ID, public subscriber count, verification timestamp and encrypted refresh token described in Section 2.2 are retained for as long as the Creator account exists, because they are the standing record that the Creator’s channel was verified. Revoking access at myaccount.google.com/permissions immediately ends our ability to read anything further from YouTube. Deleting a Creator application deletes this data with it; to have it erased while keeping the account, write to support@nanbu.in.

7. Your Rights

In accordance with applicable Indian law (including the SPDI Rules), you have the following rights regarding your personal data:

Right to access: You may request a copy of the personal data we hold about you.
Right to correction: You may request correction of inaccurate or incomplete personal data.
Right to withdrawal of consent: You may withdraw your consent to the processing of your personal data at any time by contacting us. Note that withdrawal of consent may affect your ability to use certain features of the Platform.
Right to deletion: You may request deletion of your account and associated personal data. Please note that certain data may be retained as required by law (see Section 6).

To exercise any of these rights, please contact us at support@nanbu.in. We will respond to your request within 30 days.

8. Third-Party Links & Services

The Platform may contain links to third-party websites or services (including YouTube, Razorpay, and Google). We are not responsible for the privacy practices, content, or security of these third-party services. We encourage you to review their privacy policies before providing them with your personal information.

9. Cookies & Local Storage

The Platform uses the following types of cookies and local storage:

Essential/authentication cookies: Required for maintaining your login session and ensuring the security of your account. These cannot be disabled without affecting Platform functionality.
Preference cookies: Used to remember your settings and preferences (e.g., theme selection).

We do not use advertising or tracking cookies. We do not use third-party analytics cookies (e.g., Google Analytics, PostHog). The Vercel measurement services described in Section 3 are cookieless and store nothing on your device.

10. Children’s Privacy

Nanbu is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete such information. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@nanbu.in.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised “Last updated” date and, where appropriate, by sending a notification to your registered email address. We encourage you to review this page periodically.

12. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer to address your concerns regarding data privacy:

Name: Rahul
Email: security@nanbu.in

Grievances are acknowledged within 24 hours and resolved within 7 days of receipt. Complaints about content that is unlawful are acted on within 36 hours, and complaints concerning nudity, sexual content involving minors, or non-consensual intimate imagery within 2 hours, per the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as amended.

13. Contact Us

For questions or concerns about this Privacy Policy, please contact us:

Email: support@nanbu.in

You may also visit our Contact Us page for additional ways to reach us.